eho/register-referentie
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(bff): BFF with one endpoint per portal + OIDC validation (closes #8) #64

Merged
not merged 7 commits from feat/8-bff into main 2026-07-01 09:32:45 +00:00
Conversation 0 Commits 7 Files Changed 24
+955 -5
7 Commits
Author SHA1 Message Date
notandClaude Opus 4.8 96d447832f docs(bff): demo note for the BFF front door (S-07) (refs #8)
CI / build (pull_request) Successful in 58s
Details
CI / lint (pull_request) Successful in 1m7s
Details
CI / unit (pull_request) Successful in 1m2s
Details
CI / mutation (pull_request) Successful in 3m47s
Details
CI / verify-stack (pull_request) Successful in 5m56s
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 11:15:39 +02:00
notandClaude Opus 4.8 a07d8277d6 ci(bff): compose wiring, verify-bff live check, mutation baseline (refs #8) 
Wire the bff service in compose (Keycloak authority + downstream domain/projection
URLs, depends_on domain/projection healthy + keycloak started). run-bff-check.sh
verifies the BFF end-to-end against the up stack: 401 without a token, 202 with a
real digid token minted via direct grant against keycloak:8080 (host-consistent
issuer, ADR-0010), and an anonymous public-safe openbaar register (never a bsn).
Wired as verify-bff (Makefile + verify chain + CI step). Stryker baseline for the
BFF's pure logic (OpenbaarProjection) at 100% (break 90); Program/HTTP adapters are
covered by the endpoint tests + verify-bff. CI uploads the bff mutation report.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 11:15:05 +02:00
notandClaude Opus 4.8 69d6e80378 feat(bff): committed OpenAPI contract + drift guard (refs #8) 
Document typed responses (202 SubmitAccepted / 400 / 401 on self-service; 200
OpenbaarEntry[] on openbaar) so the generated spec carries real schemas for S-08's
client. A document transformer clears the auto-populated servers block so the spec
is host-independent and deterministic. Commit services/bff/openapi.json and add a
test asserting it matches the served /openapi/v1.json (fails on drift).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 11:07:55 +02:00
notandClaude Opus 4.8 5d32d4f15e test(bff): acceptance scenario for BFF access (valid/invalid tokens) (refs #8) 
Use-case-level BDD (Reqnroll) driving the real BFF over HTTP with fake downstreams
and locally-minted tokens: a valid DigiD token is accepted and the bsn forwarded
to the domain; a tokenless submit is 401; the openbaar register is anonymous and
never exposes the bsn (ADR-0010). Real Keycloak validation is the verify-bff check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 11:03:37 +02:00
notandClaude Opus 4.8 d767430ad7 feat(bff): implement self-service submit and openbaar lookup (refs #8) 
POST /self-service/registrations requires a valid digid JWT, reads the bsn claim
and forwards it to the domain, returning 202. GET /openbaar/register is anonymous
and returns OpenbaarProjection.PublicView — rows filtered by q and mapped to the
public-safe id+status only (bsn/naam never exposed). JwtBearer validates
signature/issuer/expiry against the Keycloak digid authority (§8.3, ADR-0010).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 11:00:56 +02:00
notandClaude Opus 4.8 751ca006a7 test(bff): endpoints, JWT auth and public-safe projection (refs #8) 
Failing tests for the BFF walking-skeleton endpoints:
- POST /self-service/registrations rejects missing/malformed/wrong-key/expired
  tokens (401) and, with a valid digid token, forwards the bsn to the domain and
  returns 202 (WebApplicationFactory + a local test signing key, ADR-0010).
- GET /openbaar/register serves public-safe rows anonymously (never the bsn) and
  filters by q.
- OpenbaarProjection.PublicView (pure) filters by id and maps to id+status only.

Endpoints and PublicView are stubs so the tests compile and fail on their
assertions; the green commit implements them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 10:59:55 +02:00
notandClaude Opus 4.8 fea806848b arch(bff): ADR-0010 BFF OIDC validation + downstream boundaries (refs #8, #63) 
The BFF is the portals' only backend (§8.3): it validates Keycloak digid-realm
JWTs on POST /self-service/registrations (extracting bsn → domain), leaves
GET /openbaar/register anonymous (public lookup, S-09), and fans out to the
domain and projection over typed HTTP clients. Tests mint tokens with a test
signing key; real Keycloak validation is a live-stack verify-bff check. Records
the container OIDC issuer-mismatch wrinkle. OpenAPI is generated + committed for
the S-08 client.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 10:51:59 +02:00